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ABSTRACT 

This  paper  describes  the  formulation  and  development  of  a 
linear  model  to  support  the  single-point  vulnerability 
assessment  of  electric  distribution  systems  at  existing  and 
future  U.S.  Department  of  Defense  (DoD)  military  sites. 
The  model  uses  flow  sensitivity  factors  to  rank  candidates 
for  designation  as  “critical  components”  and  uses  triggered 
cascading  line  outages  to  confirm  the  component’s 
criticality.  The  model  is  written  in  Java  and  integrated  in  a 
package  that  employs  a  user-friendly  graphical  user 
interface  (GUI)  for  convenient  display  of  results.  This 
paper  describes  the  process  used  to  formulate  the  model 
and  presents  a  sample  application. 


1  INTRODUCTION 

This  paper  reflects  recent  work  done  for  the  U.S.  Army 
Corps  of  Engineers’  Engineer  Research  and  Development 
Center  (ERDC)  in  Champaign,  Illinois,  in  which  Argonne 
National  Laboratory  was  tasked  to  design  and  develop 
process  objects  for  conducting  a  single-point  vulnerability 
analysis  of  the  electrical  distribution  system  associated 
with  a  real  military  installation.  The  task  also  specified 
how  the  process  objects  would  be  used  to  (1)  perform 
heuristic-based  vulnerability  assessments  on  the  utility 
network  objects  and  (2)  propagate  the  effects  of  a  single¬ 
point  disruption  throughout  the  whole  electrical  system. 
The  task  implies  the  development  of  an  electrical  system 
model  that  simulates  electric  system  operations  and 
approximates  a  reaction  to  postulated  perturbations. 

The  ability  of  a  military  installation  to  accomplish  its 
mission  depends  to  a  large  extent  on  the  reliability  of  its 
supporting  energy  utility  systems.  One  of  the  most  vital  of 
these  systems  is  the  electric  distribution  system.  The 
system  that  delivers  electric  energy  at  a  military 
installation  is  essential  for  the  continued  operation  of  the 
installation’s  telecom  command  center,  its  fluid  (water  and 
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fuel)  pumping  equipment,  and  its  heating,  ventilation,  and 
air  conditioning  (HVAC)  system.  ERDC  sought  to  provide 
the  capability  to  help  identify  weaknesses  that  might  exist 
in  military  installations. 

2  PROBLEM  DEFINITION 

2.1  Single-point  Vulnerability  Problem 

The  single-point  vulnerability  assessment  task  deals  with 
the  problem  of  identifying  the  most  critical  component(s) 
of  an  electric  distribution  system  (either  a  node  or  a  link) 
with  respect  to  a  set  of  mission-critical  loads.  An  electrical 
system  component  whose  outage  would  only  affect 
noncritical  facilities  (or  loads)  could  not  be  classified  as  a 
point  of  vulnerability  under  this  problem  definition.  The 
component  must  make  the  delivery  system  inadequate  for 
serving  the  user-specified  critical  facilities  in  the  military 
installation  to  be  considered  a  point  of  vulnerability. 
Critical  facilities  are  the  buildings  or  sets  of  equipment  that 
provide  crucial  support  to  the  primary  mission  of  the 
military  installation. 

In  general,  a  single  critical  vulnerable  point  in  the 
system  could  be  defined  as  one  that,  when  disrupted, 
would  either  (1)  cause  the  isolation  of  the  critical  load  or 
(2)  result  in  a  series  of  cascading  outages  of  links  that 
would  ultimately  cause  the  system  to  collapse.  The 
important  considerations  here  are  the  overloading  of  other 
links  as  a  result  of  the  initial  outage  and  the  degradation  of 
the  system  voltage,  especially  the  voltage  at  the  target  node 
(i.e.,  a  node  bearing  a  critical  facility). 

2.2  Heuristics  for  Criticality  Identification 

Some  well-known  heuristics  for  determining  critical 
components  in  an  electrical  distribution  system  are  as 
follows: 

1.  One  rule  of  thumb  is  that  “the  most  heavily  loaded 
link/line  is  usually  a  critical  component.”  If  the  link 
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is  confirmed  to  be  among  the  participating  links, 
then  outage  of  this  heavily  loaded  link  should  be 
simulated  and  further  explored. 

2.  The  other  rule  of  thumb  is  to  “disrupt  the  largest 
supply  source  in  the  system”.  The  first  two  largest 
sources  of  power  for  the  distribution  should  be 
immediately  considered  highly  potential  single¬ 
point  vulnerabilities  for  the  system. 

The  model  to  be  developed  must  thus  be  able  to 
(l)rank  all  suspect  or  perceived  crucial  nodes  and  links 
with  regard  to  their  criticality  and  (2)  show,  via  simulation, 
the  cascading  impacts  if  those  nodes  or  links  were 
suddenly  taken  out  of  the  system. 

3  MODELING  CONSIDERATIONS  AND 
MATHEMATICAL  FORMULATION 

3.1  Linear  versus  Nonlinear 

One  important  concern  when  simulating  a  low-voltage 
electric  distribution  system  is  whether  to  use  a  linear  or  a 
nonlinear  model.  Linear  models  have  the  advantage  of 
speed,  primarily  because  they  have  no  inherent 
convergence  problem.  Linear  modeling  of  an  electric 
network  almost  always  refers  to  the  use  of  a  direct-current 
(DC)  load  flow  approach.  In  this  approach,  a  simple, 
direct,  matrix  inversion  is  needed  to  obtain  the  solution 
(power  flow  values  in  links).  Moreover,  linear  models 
require  less  data  input,  because  the  parameters  needed  to 
describe  a  linear  system  are  less  complicated  than  those 
needed  to  describe  a  nonlinear  counterpart.  The  drawback 
of  linear  models  is  that  the  results  are  approximate,  and 
caution  is  required  to  limit  deviations  that  extend  into 
intolerable  regions. 

In  nonlinear  modeling  of  a  distribution  network,  two 
paradigms  immediately  come  to  mind:  (1)  the  single-phase, 
full  alternate-current  (AC)  model  (using  the  Newton 
Raphson  method),  and  (2)  the  three-phase  load  flow. 
Distribution  systems,  unlike  transmission  systems,  have  an 
unbalanced  load,  and  the  ratio  of  resistance  to  reactance 
(R/X)  is  usually  higher  than  those  in  high-voltage 
transmission  systems.  A  higher  R/X  ratio  implies  higher 
inaccuracies  within  the  linear  model  framework. 

In  this  work,  because  of  the  scarcity  of  data  related  to 
the  military  installation  being  modeled,  the  linear  model 
was  selected.  It  was  also  noted  that  R/X  ratios  among  the 
various  links  in  the  distribution  network  were  less  than 
10%.  An  R/X  ratio  of  less  than  10%  implies  that  the 
disparities  in  results  between  AC  and  DC  simulation  are 
within  tolerable  limits. 

Several  basic  electrical  modeling  concepts  are 
presented  next  as  a  part  of  the  discussion  on  problem 
formulation. 


3.2  Review  of  DC  Load  Flow  Formulation 

The  concept  of  DC  load  flow  is  presented  here  for 
convenience  to  unfamiliar  readers.  The  DC  load  flow 
program  is  used  to  determine  line  flows  when  scheduled 
power  injection  and  demand  in  the  nodes  are  given.  In  the 
DC  load  flow  formulation,  the  relationship  between  the  bus 
real  power  injections  and  the  bus  voltage  phase  angles  is 
shown  in  (1)  (Wollenberg  1996). 

[AP]  =  [ET]  [A0]  (1) 

where 

[AP]  =  vector  of  net  bus  power  injection,  per  unit 
[A0]  =  vector  of  net  changes  in  bus  voltage  phase 
angle,  in  radians 

[B?]  =  matrix  consisting  of  constant  line  susceptances 
(inverse  of  reactance),  expressed  per  unit  (Crow 
2003) 

The  DC  load  flow  only  represents  real  power  flows 
(i.e.,  MW)  in  transmission  or  distribution  lines  and 
transformers.  It  gives  no  indication  of  what  happens  to 
voltage  magnitudes  or  megavolt-ampere-reactive  (MVAR) 
or  megavolt-ampere  (MV A)  flows  (Stott  1974). 

Given  the  Ps  (i.e.,  power  injections,  plus  for 
generators  and  minus  for  loads),  the  bus  angles  are 
determined  as  shown  by  (2). 

[A0]  =  [B?]  4  [AP]  (2) 

The  power  flowing  through  each  line  using  the  DC 
power  flow  is  then  calculated  using  (3): 

p»=(ei-ekyxft  (3) 

where  xik  is  the  line  reactance  between  Nodes  i  and  k. 

The  power  injection  in  a  Node  i  is  therefore  calculated 
as  shown  by  (4). 

P/  =  Z  VbusesP/,  (4) 

3.3  Transmission  Distribution  Factor  Concept 

Another  concept  fundamental  to  the  problem  formulation 
is  presented  is  the  concept  of  transmission  distribution 
factors  (TDFs).  The  TDF  concept  shows  how  a  certain 
amount  of  power  transmitted  from  one  node  (sending 
node)  in  the  system  to  another  node  (receiving  node)  is 
distributed  among  the  various  paths  of  lines  that  link  the 
sending  node  to  the  receiving  node  (Christie  2000). 
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When  the  generators  are  taken  one  at  a  time,  the  TDFs 
of  all  lines  in  the  distribution  system  can  be  calculated 
given  the  identities  of  the  target  node  (i.e.,  the  node 
bearing  the  critical  facility)  and  the  selected  generator 
node.  This  calculation  is  accomplished  by  using  the  basic 
DC  power  flow  equation  with  modifications  in  the  [AP] 
vector  (i.e.,  power  injection  and  load  vector)  such  that  the 
target  node  is  represented  as  a  negative  one  (-1)  while  all 
selected  generator  node  is  represented  as  +1.  (This  is 
called  a  point-to-point  power  transfer  analysis.)  All  the  rest 
of  the  nodes  are  set  to  zero.  Mathematically,  this  is  written 
as  shown  in  (5)  for  the  determination  of  the  bus  angles  for, 
say,  a  six-bus  system: 


MHb']-1 


0 

-1 

0 

0 

1 


<—  target  "load"  bus 


(5) 


<—  selected  generator  node 


TDF  is  also  defined  as  the  ratio  of  the  delta  flow  in  the 
line  to  changes  in  MW  load  at  the  test  node.  However, 
since  the  perturbation  at  the  test  node  was  assumed  to  be 
minus  unity,  the  delta  flow  value  (which  is  a  fraction)  is 
identical  to  the  TDF  for  that  line.  The  TDF  is  an  indication 
of  how  much  the  line  flow  (for  a  specific  line  in  the 
distribution  system)  would  change  for  an  incremental 
change  in  MW  load  at  the  test  node. 

3.4  TDFs  in  Multiple  Generator  Single  Load 
Configurations 

The  previous  discussion  centered  on  how  to  calculate 
TDFs  in  a  scheme  involving  point-to-point  power  transfers. 
This  section  discusses  how  to  determine  TDFs  when  it  is 
assumed  that  multiple  generators  operate  simultaneously  to 
send  power  across  the  network  to  a  single  load.  This  is 
called  the  weighted  TDF  calculation  approach. 


In  the  case  of  the  equation  above,  the  selected 
generator  node  absorbs  all  the  incremental  load  changes 
occurring  in  the  target  node.  Note  that  in  Equation  5,  the 
slack  node  (swing  generator)  is  not  included.  All  units  of 
measure  are  specified  in  per  unit,  except  for  9,  which  is  in 
radians.  Note  also  that  in  [B’j,  the  rows  and  columns 
corresponding  to  the  slack  bus  are  eliminated  to  make  the 
equation  solvable  or  nonsingular.  The  A9  for  the  slack 
node  is  always  set  to  zero,  by  definition. 

To  evaluate  the  TDF  of  lines  with  the  slack  bus  as  the 
selected  generator,  (5)  changes  to  (  6)  as  shown  below: 


The  weighted  TDF  calculation  approach  proceeds  as 
follows: 

(a)  Calculate  the  sum  of  all  generator  outputs  and 
determine  the  percent  share  contribution  of  each 
generator.  Mathematically,  this  could  be 
expressed  as  shown  by  (8)  and  (9)  as  follows: 

Psum  =  £  P,  i=  1,  2...N  (8) 

Share_P,  =  P,l Psum  *  100%  (9) 

where 


[ad] = [B-r1 


0 

-1 

0 

0 

0 


<—  target  "load"  bus 


(6) 


Note  that  the  [AP]  vector  in  (6)  has  all  zero  elements 
except  for  the  target  bus,  which  has  -1 . 

The  TDFs  for  each  line  for  each  case  of  point-to-point 
power  transfer  is  simply  the  delta  flow  calculated  from  the 
above  equations.  Once  [A9]  is  calculated,  the  TDF  for  each 
line  is  calculated  using  (7)  (Christie  2000): 

TDF  ij  case  y—  Delta  flow  case  y  [ (A0,  A9j)/x  y  ]  case  y 

y  =  1,2,. ..5  (7) 


P,  =  output  of  generator  i  in  MW 
i  =  generator  index 
N  =  total  number  of  generators  or 
supply  sources 

Share  P,  =  percent  share  of  Generator  i 
in  total  generation  output 


(b)  Determine  the  weighted  TDF  by  first  calculating 
the  9  in  all  nodes  in  the  network  and  then  using 
the  Share_Pj  values  calculated  in  Step  (a).  The 
appearance  of  the  DC  load  flow  for  determining 
9  by  using  the  Share  _Pi  values  for  a  six-bus 
system  (assuming  Node  1  is  the  slack)  is  shown 
by  (10): 


where 


A9,  =  change  in  node  angle  in  node  i 
xj  =  series  reactance  between  nodes  i  and  j, 
per  unit 

y  =  case  number  (e.g.,  Case  1  when 
Generator  1  is  selected) 

TDF,,  =  transmission  distribution  factor  for  line  ij 
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U 

-1 

<—  target  load  bus 

0 

.4 

<—  supply  node  Share_P5  40% 

.1 

<—  supply  node  Share_P6  10% 

In  the  case  of  the  equation  above,  the  slack 
(Node  1)  is  assumed  to  have  a  Share_P)  of  0.5  to 
make  the  sum  equal  to  unity  (i.e.,  0.4  +  0.1  +  0.5  = 
1 .0).  All  units  of  measure  are  per  unit.  Note  that  in 
B’,  the  rows  and  columns  corresponding  to  the  slack 
bus  are  eliminated  to  make  the  equation  solvable  or 
nonsingular.  The  A9  for  the  slack  node  is  always  set 
to  zero. 

(c)  Then  the  TDFs  could  be  calculated  as  usual, 
using  (11). 

TDF  [j  case  y—  Delta  flow  case  y  —  |  ( A ( ) j  —  A0j)/xjj  ]case  y 

y  =  1,2,. ..5  '(11) 

where 

A9j  =  change  in  node  angle  in  node  i 
Xy  =  series  reactance  between  nodes  i  and  j 
y  =  case  number 

TDFjj  =  transmission  distribution  factor 
for  line  ij 


The  new  (post-outage)  output  of  the  surviving 
generators  is  then  would  be: 


F*  6  post-outage  1*6  pre-outage  +  Post-outage  share  of  P6*P5  pre-outage 
Pi  post-outage  Pi  pre-outage  ^  PoSt-OUtage  share  of  P]  P5  pre-outage 

The  system  with  the  new  dispatch  and  system 
configuration  is  then  re-simulated  by  using  the  DC  load 
flow,  and  overloaded  lines  are  noted  and  observed.  If  a 
second-stage  overloading  occurs,  it  is  a  signal  that  a 
cascading  line  failure  could  occur.  In  such  cases,  the 
second-stage  overloaded  line  (in  addition  to  the  first-stage 
overloaded  line)  must  be  taken  out  of  the  system,  and  the 
system  is  again  re-simulated.  If  there  is  a  third-stage 
overloading,  the  outage  of  the  third-stage  overloading  must 
be  simulated  by  using  the  DC  load  flow.  The  sequence  of 
line  trippings  must  be  recorded  to  show  the  propagating 
effect  of  the  initial  disruption. 

The  launching  of  the  DC  load  flow  is  triggered 
automatically.  If  the  simulation  does  not  result  in  a  second- 
stage  overloading,  the  link  is  disregarded  as  being  critical. 
Otherwise,  the  second-stage  overloaded  lines  should  be 
identified  and  the  system  should  be  re-simulated, 
assuming  again  that  these  lines  (in  addition  to  the  first- 
stage  outaged  line)  are  removed. 


3.5  Flow  Distribution  after  Generator  or  Line 
Outages 

To  simulate  the  impact  of  the  outage  of  a  link,  a  program 
must  be  developed  to  “eliminate”  a  line  from  the  link  input 
data  matrix.  If  a  link  to  be  outaged  does  not  isolate  any 
generator,  then  the  link  can  be  “deleted,”  and  a  DC  load 
flow  could  be  ran  to  determine  the  new  loading  in  the 
lines.  If  overloading  occurs,  these  violations  should 
automatically  be  noted  by  the  program;  however,  if  the  link 
to  be  outaged  isolates  a  generator,  the  output  of  that 
generator  (which  may  be  isolated)  should  be  distributed  in 
some  fashion  (possibly  in  proportion  to  capacity  or 
generation  level)  among  the  surviving  generators  before 
the  DC  load  flow  is  run.  Again,  overloading  may  be 
observed  and  should  automatically  be  noted. 

In  the  case  of  (10),  if,  for  example,  a  link  connected  to 
Node  5  is  outaged  (and  therefore  isolates  Node  5),  then 
Node  5’s  pre-outage  output  is  distributed  among  the 
remaining  generators  as  shown  in  (12). 

Post-outage  share  of  P6  =  0. 1/(0. 1  +  0.5)  =  16.7%  (12) 

Post-outage  share  of  Pi  (Slack)  =  0.5/(0.1  +  0.5)=  83.3% 


4  ALGORITHM  FOR  SINGLE-POINT 
VULNERABILITY  DETERMINATION 

4.1  Steps  in  Vulnerability  Assessment 

The  three  concepts  described  above  were  used  to  adopt  a 
deterministic  approach  to  identify  the  single-point 
vulnerability  of  the  distribution  system.  The  steps  for 
assessing  single-point  vulnerability  of  the  links  follow 
here.  Steps  for  assessments  involving  nodes  follow  a 
similar  logic.  A  requisite  of  these  steps,  is  for  the  military 
manager  of  the  site  to  identify  and  tag  the  critical  facilities 
within  the  site  or  installation. 

Step  1.  Identify  all  links  that  are  involved  in  delivering 
power  to  the  facility. 

This  undertaking  traces  the  flow  of  power  from  the 
source(es)  to  the  facility  under  consideration  and,  in  the 
process,  identifies  all  links  supporting  the  flow.  (These 
links  are  sometimes  called  “participating  links”  in  this 
document.)  A  TDF-based  approach  is  employed  to  identify 
which  lines  are  sensitive  to  the  load  when  certain  sources 
of  power  are  assumed.  The  link  with  the  largest  sensitivity 
to  the  facility  is  the  most  promising  candidate  for  single- 
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point  vulnerability  and  is  the  line  most  crucial  to  the 
facility  (i.e.,  it  is  the  line  carrying  the  greatest  amount  of 
power  to  the  facility). 

The  amount  of  interrupted  power  caused  by  a 
disrupted  line  at  the  critical  facility  is  roughly  equal  to  its 
TDF  (sensitivity  factor)  multiplied  by  the  magnitude  of  the 
load  in  MW.  So,  if  a  link  has  a  TDF  of  1 .0,  cutting  off  the 
link  would  completely  isolate  the  critical  facility.  (This 
would  be  expected  of  the  service  line  linking  the  facility  to 
the  distribution  grid.) 

If  the  facility  is  served  by  several  feeders  (e.g.,  three) 
or  from  several  sections  of  the  network,  the  facility  is  said 
to  have  high  electric  service  reliability.  This  is  so  because 
it  would  take  three  single  point  disruptions  (in  our 
example)  to  isolate  the  facility.  However,  a  systems 
analysis  is  needed  to  determine  if  the  remaining  links 
would  have  enough  capacity  to  absorb  the  power  shifted  to 
them  by  the  disrupted  line. 

In  carrying  out  the  TDF  calculation,  the  process  first 
assumes  a  point-to-point  transfer  of  power.  That  is,  the 
generators  are  examined  one  at  time,  first  to  determine 
which  links  are  involved  in  delivering  power  from  that 
specific  generator  to  the  target  load  and  second  to 
determine  which  among  those  identified  links  has  the 
highest  TDF  or  sensitivity  factor.  The  link  with  the  highest 
sensitivity  factor  is  a  candidate  (maybe  secondary)  for 
single-vulnerability  assessment.  The  entire  process  takes 
into  account  only  the  first  five  largest  generators  in  order  to 
minimize  the  computation  time  and  search  effort. 
However,  the  five-candidate  list  would  be  enough  to 
capture  some  of  the  most  critical  links.  The  combined 
effect  of  having  all  generators  operating  simultaneously 
could  be  determined  by  adopting  the  point-to-point 
approach  and  then  applying  the  principle  of  superposition. 
Alternatively,  the  weighted  TDF  approach  could  be 
employed. 

Step  2.  Rank  the  links  according  to  their  TDFs. 

A  disrupted  link  with  a  TDF  of  1 .0  isolates  the  facility  and 
cuts  off  power  completely.  If  the  link  involved  is  near  the 
facility,  the  outage  would  not  be  as  widespread  as  if  the 
link  was  nearer  to  the  source.  (This  demonstrates  that  the 
concept  of  “proximity  of  supply”  to  the  target  node  is  a 
factor  in  determining  critical  single  vulnerable  points.) 
This  link  and  the  nodes  at  its  ends  are  automatically 
identified  as  “single-point  vulnerabilities.” 

If  a  link  has  a  TDF  of  less  than  1.0,  it  is  possible  for 
other  links  to  support  the  facility,  subject  to  their  individual 
design  capacities.  A  systems  analysis  should  then  be 
conducted  to  determine  if  the  outage  of  the  primary  link 
causes  a  cascade  of  overloading  events  among  the 
surviving  links.  A  link  that  has  a  high  TDF  but  does  not 


cause  the  overloading  of  other  links  is  not  a  single-point 
vulnerability  candidate.  If,  however,  the  link  with  a  high 
TDF  causes  another  link  to  be  overloaded,  that  second 
overloaded  link  should  also  be  taken  out  to  determine  if 
further  overloading  occurs.  If  it  does  occur,  the  link  is  a 
single-point  vulnerability  link.  Simulation  should  stop  after 
the  outage  of  the  second  overloaded  line  is  completed. 
After  this,  it  would  be  fair  to  conclude  that  the  disturbance 
would  propagate  throughout  the  system  and  that  the  system 
would  not  adequately  serve  the  critical  facility. 

Since  the  simulation  would  consider  both  nodes  and 
links,  it  is  appropriate  that  an  outright  DC  load  flow 
simulation  be  performed  to  determine  the  second-stage 
overloading  events. 

Step  3.  Simulate  extent  of  cascading  effects. 

As  each  link  with  high  TDFs  is  assumed  to  be  outaged, 
overloading  in  certain  lines  will  occur.  It  is  assumed  that 
overloaded  lines  will  subsequently  trip,  thereby  creating  a 
second-tier  outage  condition.  The  second-tier  outage 
situation,  when  simulated,  could  lead  to  a  third-tier  outage 
situation  and  then  to  a  fourth  and  so  on,  until  the  system 
splinters  into  island  grids.  Island  grids  must  maintain  a 
supply-demand  balance.  Because  the  generation  sources 
are  dispersed  throughout  the  installation  and  come  in 
various  sizes,  an  island  grid  may  contain  no  generation 
sources  at  all.  This  implies  total  blackout  for  the  island 
grids  having  no  generation.  From  the  perspective  of  the 
installation,  this  is  seen  as  a  further  loss  of  loads  (i.e., 
unserved  demand).  Other  island  grids  with  generation  and 
loads  greater  than  supply,  will  require  load  shedding. 
Overall,  as  the  system  collapses  and  island  grids  form, 
there  would  be  a  general  net  loss  of  load  within  the 
installation.  The  sequence  of  line  trippings  is  recorded  to 
show  the  propagating  effect  of  the  initial  disruption. 
Figure  1  illustrates  the  concepts  of  system  collapse  and 
island  grid  formation  after  the  vulnerability  assessment 
steps  outlined  above  characterize  the  response  from  a 
critical  link  outage.  A  sequence  of  island  grid  formation 
after  the  loss  of  a  critical  generator  is  shown  in  Figure  2. 

4.2  Codes  and  Flowchart 

The  flowchart  for  algorithm  execution  is  shown  in 
Figure  3.  The  flowchart  highlights  the  process  of 
identifying  critical  links  or  nodes.,. 

The  code  was  written  in  Java  and  integrated  in  a 
package  with  a  user-friendly  GUI.  The  GUI  is  highly 
sophisticated,  addresses  a  broad  range  of  user 
requirements,  and  deserves  a  separate  paper  for  a  detailed 
description. 
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Figure  1:  A  64-node  network  splinters  into  six  island  grids  after  a  critical  link  indicated  in  “Sequence  1”  tripped  and 
triggered  cascading  line  outages.  Each  colored  area  represents  a  splintered  island  grid.  Location  of  line  outage  is 
indicated  by  the  yellow  circle. 


Figure  2:  Three  island  grids  formed  as  a  result  of  the  outage  of  a  critical  generator  in  “Sequence  1.”  Line  outage  is 
indicated  by  the  yellow  circle.  The  other  events  that  ensued  are  labeled  as  “Sequence  2”  and  “Sequence  3.” 
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Figure  3:  Simplified  flowchart  for  single-point 
vulnerability  assessment  code. 


5  IMPLEMENTING  THE  SCHEME  AND 

SIMULATION  RESULTS 

5.1  Important  Assumptions 

Time-of-day  assumptions  represents  a  particular  modeling 
concern.  Time  of  day  relates  directly  to  the  system 
loading  condition  (i.e.,  considering  both  generator 
dispatch  and  load  distribution)  and  contributes  to  the 
definition  of  the  component’s  criticality.  A  component 
may  not  be  critical  during  low-load  or  average-day 
conditions  but  be  critical  during  peak-day  conditions 
when  reserve  margins  are  at  their  lowest. 

Another  important  assumption  is  that  in  most  military 
installations,  there  are  no  sophisticated  automatic  load¬ 
shedding  schemes  in  case  there  is  a  supply-demand 
imbalance.  This  assumption  implies  that  the  system 
demand  remains  fairly  constant  as  the  cascading  event 
progresses.  During  final  settlements  into  various  island 
grids,  the  generation  sources  in  each  island  grid  are 
allowed  to  re-dispatch  to  match  demand  and  thus  maintain 
the  supply-demand  balance. 

There  were  no  impedance  data  for  a  number  of  lines 
at  the  installation.  Argonne  developed  an  impedance 
reconstaiction  module  to  generate  approximate 
impedance  values  for  data-deficient  lines.  In  the  process, 
certain  assumptions  were  made  about  the  construction 


materials  (e.g.,  copper  or  aluminum)  and  distances 
between  wires  on  the  basis  of  their  voltage  levels. 

Lastly,  the  primary  supply  substations  that  feed 
power  to  SiteX  from  the  local  grid  are  represented  as 
generators  in  the  model. 

5.2  Features  and  Characteristics  of  the  Subject 
Military  Installation 

For  security  reasons,  the  name  of  the  actual  military 
installation  whose  electric  system  was  subjected  to 
vulnerability  assessment  is  not  disclosed  here;  instead,  it 
is  called  Site  X.  This  site  encompasses  a  large  area  and  is 
divided  into  several  partitions.  In  the  initial  testing  phase 
of  the  vulnerability  assessment  model,  the  application  was 
directed  to  Partition  1  of  Site  X.  The  layout  of  facilities  in 
Partition  1  is  shown  in  Figure  4.  The  general 
characteristics  of  the  distribution  system  in  that  partition 
are  summarized  in  Table  1. 


Figure  4:  Layout  of  electric  distribution  system  showing 
various  nodes  and  links  as  depicted  in  the  model’s  GUI. 
Yellow  and  green  indicate  normal  flow. 


Table  1 :  Salient  Features  of  Electric  System  for  Site  X. 
(The  abbreviation  SS  stands  for  “substation.”) 


Parameter 

Description 

1 .  Total  demand 

8.3  MW 

2.  Total  no.  of  lines 

294 

3.  Total  no.  of  buses 

288 

4.  Voltage  levels 

12.5  kV,  480  V 

5.  No.  of  supply  SSs 

2 

6.  Voltage  ratio  of  SS 

230/12.5  kV 

7.  Wiring  methods 

Under  -  and  aboveground 

8.  No.  of  on-site  generators 

Numerous;  one  active 

9.  System  configuration 

Looped/radial 

Note  that  the  integrative  environment  within  which 
the  model  operates  includes  other  infrastaictures,  such  as 
the  water  network,  natural  gas  system,  buildings,  and 
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roads  These  are  interdependent  within  the  installation, 
discussed  in  greater  detail  in  one  of  the  listed  references 
(see  Bozada  2006).  Including  other  infrastructures  enables 
the  model  to  extend  its  analysis  to  consider 
interdependency  implications  among  the  various  coupled 
infrastructures,  (e.g.,  how  disruptions  in  an  electric 
system  affect  the  water  system  and  natural  gas  network). 

5.3  Simulation  Results 

An  application  requiring  the  vulnerability  assessment 
model  to  identify  and  rank  the  most  critical  lines  in 
Partition  1  of  Site  X  was  undertaken  by  the  authors.  The 
manner  by  which  the  simulation  was  triggered  via  the 
GUI  is  shown  in  Figure  5.  The  resulting  ranked  links  in 
Site  X  are  listed  in  an  output  table  shown  in  Figure  6.  The 
results  indicate  that  Line  Node  7-1-6892  to  Node  7-1-622 
is  the  most  critical  line.  The  outage  of  this  line  would  lead 
to  system  collapse,  de-energizing  288  nodes  and  290 
lines.  The  location  of  this  most  critical  link  is  shown  in 
Figure  7. 


Figure  5:  Model’s  GUI  showing  user  action  to  start  a 
ranking  of  critical  links  in  Site  X. 


Highlighting  a  specific  link  in  the  tabular  output  pane  and 
clicking  it  simulates  the  outage  of  that  specific  link.  In 
Figure  8,  Link  7-1-4540  to  7-1-4522  is  selected  as  the 
outaged  line  (i.e.,  its  corresponding  record  is  highlighted 
and  pointed  to  by  the  cursor  in  the  tabular  output  pane). 


Figure  7:  Location  of  the  most  critical  link  identified 
in  the  table  shown  in  Figure  6. 


Figure  8:  Exploration  of  segments  affected  by  the 
tripping  of  a  specific  link  of  interest. 


Figure  6:  Tabular  output  pane  showing  results  from  action 
initiated  in  Figure  5.  Table  shows  list  of  critical  lines 
ranked  from  the  most  to  the  least  critical. 


The  corresponding  sections  isolated  or  affected  by  this 
action  is  indicated  by  segments  of  the  electric  network 
that  are  in  black.  The  green  lines  indicate  unaffected 
segments. 

6  SUMMARY  AND  CONCLUSIONS 

This  work  illustrates  how  linear  modeling  concepts  in 
power  system  simulation  are  used  in  vulnerability 
assessment  studies.  Although  the  linear  models  are 
approximate,  they  are  sufficient  for  assessing  the  relative 
criticality  of  components  in  the  distribution  system  of  a 
military  installation.  The  model  has  been  used  by  DoD 
provide  improved  and  deliberate  security  measures  to 
protect  its  military  installations. 
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